7 ms·
Mountain Lion quietly includes app blacklist and security restrictions
- mikeryan 14y agoInteresting, spent some time perusing the Exceptions.plist file from what I can tell there's nothing explicitly hinky. Looks like it could be big brotherish, but most of the file looks, well helpful. Most Browsers and BitTorrent clients are set to quarantine files that they create. A lot of keys for App Store categorization etc.
- delinka 14y agoWhat with Gatekeeper* and Developer ID, who didn't see this coming? How else do you protect the walled garden from vile betrayers that come in via Developer ID? Criminal Hacker gets Dev ID, makes malicious app, distributes said app, runs for months, then one day whamo! it does Nasty Shit. Apple blacklists the app and the Dev ID certs. Easier worm and virus control. At least until one of these rogue devs finds a privilege escalation bug that gets it out of the sandbox and also into more privileged execution. It's not a magic bullet, but it'll be a good thing unless they abuse it. An example of Apple's track record in this regard would be GPL apps on the App Store - they'll pull the app from the store but I have yet to hear Apple 'remote wiping' someone's previously downloaded apps. Tangentially, I'm a little miffed at spending $100 to get certificates to do Developer ID, but in the Grand Scheme of Business, it's just not that much money. *I have flashbacks to 'The Net' - I shudder
- __david__ 14y agoIt's worth noting that 75% to 80% of the (pretty short) blacklist is Apple's own stuff.
- wtallis 14y agoAnd those are probably some of the most annoying bits, since many of us prefer the old iCal, Address Book, and Front Row.
- pooriaazimi 14y agoI bet $50 the old iCal, Address Book and Front Row are not compatible with new security restrictions introduced in ML, so again you should be happy Apple has blacklisted them. That doesn't mean that I like the current state of these apps any more than you.
- ceejayoz 14y ago> Tangentially, I'm a little miffed at spending $100 to get certificates to do Developer ID, but in the Grand Scheme of Business, it's just not that much money. My understanding is that Gatekeeper signing is free.
- taylorfausak 14y agoIt's free for Mac Developer Program members [1]. In other words, it's free once you spend $100 per year. [1]: https://developer.apple.com/resources/developer-id/ https://developer.apple.com/resources/developer-id/
- runn1ng 14y agoThis is basically Apple's definition of "free".
- delinka 14y agoDepends on how you define "free." Apple says "no additional charge over your Mac Dev membership. It's included with the Mac Developer Program." I spent two entire days watching WWDC videos and digging around on developer.apple.com trying to find out how to get certificates without paying Apple the $99 for Mac Dev. The Apple employees that I am connected to were also surprised to find out that it wasn't free outside the Mac Dev program. A former Appler helping me dig around also noted that Apple never said it'd be "free." If you can find somewhere Apple said it would be free, I'd love to dig deeper.
- deleted 14y ago[deleted]
- batista 14y ago>It's not a magic bullet, but it'll be a good thing unless they abuse it. An example of Apple's track record in this regard would be GPL apps on the App Store - they'll pull the app from the store but I have yet to hear Apple 'remote wiping' someone's previously downloaded apps. Actually they won't "pull the app" by themselves. At least in the one example I'm aware off, a minor contributor to a project (VLC) specifically _asked_ Apple to remove the app from the iOS app store, pissing on both the users wanting it AND the developers doing the porting for free and making the source code available for everyone, because it being on the app store didn't satisfy some GPL technicality.
- deleted 14y ago[deleted]
- r00fus 14y agoThe move by the VLC developer (Rémi Denis-Courmont) [1] makes more sense when you realize was working for Nokia at the time [2]. [1] http://www.ilounge.com/index.php/news/comments/vlc-developer-claims-app-store-infringing-vlc-license/ http://www.ilounge.com/index.php/news/comments/vlc-developer... [2] http://www.linkedin.com/in/remidenis http://www.linkedin.com/in/remidenis
- 0x0 14y agoHoly shit, I never realized! That's a bit of a scandal!
- lmm 14y agoIt's not a technicality. It was violating the GPL. I wouldn't want a GPL project I'd contributed to released that way either.
- batista 14y agoYes, but other people working on the GPL project, including more major contributors didn't have a problem with the porting and availability on iOS. I guess all it takes is a misguided picking of licence in the beginning and a zealot that contributed somewhat (even marginally) to ruin it for all the other contributors who could care less about 100% enforcement. Maybe that explains why BSD and MIT style licences rule the roost when it comes to new projects on GitHub...
- ZoFreX 14y agoWindows 7 has something similar, but rather than blocking the app just tells you something like "This application has known problems on Windows 7" and gives you options to check for a fix online, or to run the application anyway (in most cases. there are a select few where it doesn't let you run them at all, but you still get a button to check for a solution). Even if Apple sticks with blocking the application entirely (which in this particular case they're probably right to do so, as it would cause a kernel panic) it would be nice to put something actionable in the dialog.
- eridius 14y agoHas automatically checking for a fix online ever worked? Admittedly I'm only an infrequent user of Windows, but I've never once had it actually do anything.
- ZoFreX 14y agoYup! From Vista onwards the various incarnations of that started being more effective for me. In the case of incompatible programs it points you at the latest version of that program, if that fixes the problem. When applications crash and you send the report to Microsoft, I've had fixes come back in some cases including telling me to update a particular driver, or even giving me a Windows hotfix specific to that problem.
- deleted 14y ago[deleted]
- therealarmen 14y agoThis may be a small step towards further "appification" of the MacBook line of products, which for better or for worse has been Apple's M.O. lately. On one hand, I love opening up the App Store on my MacBook and flipping through all the shiny icons in one central location that is safe and easy to use. On the other hand, I worry about Apple controlling the entire distribution channel for consumer software.
- runjake 14y agoThis doesn't look evil. It looks like an internal stop-gap measure to prevent the execution of incompatible application versions that crash the OS. Most of the list are older versions of Apple's own apps. It's "hidden" because it's almost certainly a hacky stop-gap. As far as I can tell, it isn't live updating or checking for new signatures, so the signatures are probably updated on a release basis as issues are found.
- Someone 14y agoI completely agree. It looks like a nice hack that can help you ship in time. Let's say testing shows a few older apps that have drivers that really misbehave on the new system, and you really want to ship this week. To me, adding those apps to a fixed "do not run" list seems to be preferred over shipping later or shipping an OS that will crash with a large portion of your users. That is especially true if those apps have free or cheap updates. Conspiracy theorists: for Apple, this technique dates back to at least the eighties or so. At some time, Apple introduced a system error "Application has special memory requirements" that basically meant "Sorry, we cannot run Excel 2.2" (text and version may be of). Reason was that that Excel used some bits in pointers for data storage. The new OS or hardware started using those bits itself, so that version of Excel could not run on with it. So, the Finder refused to run that program.
- brudgers 14y ago"a hackey stop-gap." The term is "kludge."
- revscat 14y agoThose seem synonymous, both syntactically and emotionally.
- wtallis 14y ago"Stop-gap" has a slight implication that it's temporary. A kludge may be forever. Though, in this case, the stop-gap is at least indefinite from Apple's perspective, since they have no plans to restore binary compatibility for badly-written or otherwise broken drivers and applications, and it's up to the third-party vendor whether to issue a free patch.
- joe_the_user 14y agoAll this stuff does disturb a bit but as a less-than-lover of Apple, I'll still admit that whitelists are where the real big-brotherishness comes in. Blacklists are inherently more an "FYI, this is a problem" approach.
- ryannielsen 14y agoFor what it's worth, this mechanism was actually introduced in and first employed by Lion.
- wtallis 14y agoI've got the Exceptions.plist on my 10.6 system, and it's got 48 entries in the MinimumVersionRequirements section. Mostly Apple stuff, but also Parallels Desktop (and I've triggered the error message with this), Intego Virus Barrier and NetUpdate, Elgato EyeTV, and a few others that are a bit surprising: SPSS 17.0, Macromedia Director MX 2004, and Asobo's video game tie-in to Ratatouille.
- jakobe 14y agoThere was a problem when installing Snow Leopard, where your computer would crash on boot if you had a specific third party extension installed (I think it was Application Enhancer). I assume to prevent similar problems, Apple started disabling incompatible software after system upgrades in Lion. The blacklist can't really be called "quiet": On first boot after system upgrade, a dialog box pops up that tells you that incompatible software was moved to a special folder. The affected stuff is mostly kernel extensions that become incompatible.
- smackfu 14y ago>Not surprisingly, the list of bundle IDs are all web browsers and torrent downloaders. This part is really interesting, that Apple is externally enforcing the quarantine bit rather than relying on the apps to set it.
- ryannielsen 14y agoThat's been the case since file quarantining was introduced.
- DHowett 14y ago> I immediately jumped to the conclusion that Apple was “blacklisting” the app for political reasons > Wow, they really don’t want me to open this app! I can't really imagine why one would instantly jump to the first conclusion, and then after a kernel panic still believe it to be malice on the part of the operating system developer. The instant a kernel panic is thrown into the mix, you barely need to check the crash log to realize that there's something fundamentally incompatible. I was nearly expecting a follow-up line to say "It looks like Apple is patching the VMware modules at runtime, to cause them to crash!" > ... it’s worth considering whether they will be tempted to use these powers for less honorable goals. In addition to the version blacklist described here, there's the much-bandied-about "killswitch" in the iOS app store. In the years since iPhoneOS 2.0, has Apple used it for less honourable goals than platform security? Come to think of it, has Apple used it at all?
- ryannielsen 14y agoThere is a somewhat justifiable reason for the author to jump to that conclusion – VMware Fusion 4.1 (accidentally?) supports the virtualization of Snow Leopard, which violates Apple's EULA. That feature was very quickly removed in a 4.1.x update. Given that Fusion 4.1.0 is blacklisted while 4.1.3 works fine on Mountain Lion, it's not entirely unreasonable to think that Apple purposefully disabled 4.1.0 to prevent users from virtualizing Snow Leopard against their will. Not the conclusion I would have jumped to right off the bat, but I can see the train of thought.
- smcnally 14y agoI got a similar message when I found I'd had to reinstall git. Pulled down an image from google code, then git-scm and received a ~"cannot install from unsigned source." I'm not sure why I had to reinstall in the first place. Specifying "Allow software from ANYWHERE to run" did the trick. This might be off-putting to some.
- MaysonL 14y agoActually, this mechanism has been there since at least Snow Leopard, if not before. See the screenshot of Exceptions.plist on page 4 of [0]. [0]http://www.intego.com/mac-security-blog/dl/How-the-Anti-Malware-Function-in-Apples-Snow-Leopard-Works.pdf http://www.intego.com/mac-security-blog/dl/How-the-Anti-Malw...
- deleted 14y ago[deleted]
- mmariani 14y agoI have an iPhone 4 (out of warranty) that all of sudden got stuck on dock mode and stopped playing sounds trough it's speaker. The only time I could hear something from the speaker was the ringtone when someone was calling me. Before I opened the phone to try to find a fix, I wanted to resolve the issue with software. That because I knew it was a software and not a hardware issue. Googling around I've found a fix. I had to jailbreak and SSH into the phone in order to delete a launch deamon. After downloading the app for the job, to my amusement, when i executed the app nothing happened. I quickly fired up a terminal window so I could run the app. It ran. I could jailbreak the device, remove the service, and then the issue was gone. So Apple is really blacklisting apps in Mountain Lion, not only to protect users. But to keep us from running things they don't like. Lucky for us that we're hackers. ;)
- Karunamon 14y ago> But to keep us from running things they don't like. Really. Perhaps you could point to the app on the openly viewable blacklist?